We’re taking a slightly different format for this final day of Tagsmas, focusing on what has turned out to be a fairly pernicious vulnerability that will likely be a perennial threat to organizations of all shapes and sizes.
As we careen past the two-year anniversary of CVE-2021-44228, it's essential to examine the events that have transpired and provide guidance for addressing this issue in 2024. The Log4j vulnerability, also known as Log4Shell, was discovered in December 2021 and significantly impacted organizations worldwide.
GreyNoise was at the forefront of capturing the initial onslaught of mass exploitation attempts, which we’ve detailed previously:
As the annotated timeline shows, attackers wasted no time launching mass exploitation attempts with increasingly more complex, comprehensive, and obfuscated payloads. The associated GreyNoise activity graph further shows that Log4Shell attempts have entered the “pervasive background noise of the internet” stage, with some recent spikes in exploitation.
Thousands of commercial applications and an unimaginable number of enterprise in-house developed applications were, and still are, vulnerable to this attack vector. A recent post and report by Veracode further paints a bleak, but not hopeless, picture of the state of affairs of both Log4j and software weaknesses in general.
GreyNoise Labs continues to see new Log4Shell payload clusters that use novel obfuscation techniques or insert JNDI exploit strings in novel places.
If you are a GreyNoise account holder, you can poke around a very interesting day in December 2023. Note that public Sift data ages out of the Sift application after 30 days, but you can email labs@greynoise.io if you’d like a copy of the payloads for that day).
And, yes, the “spray and pray” header approach that was identified within days of the vulnerability being made public is alive and well today:
Most recently, the North Korean state-run Lazarus APT group exploited Log4Shell in publicly facing and unpatched VMware Horizon servers. They used their access to deploy custom remote access trojans (RATs) written in DLang, a programming language not commonly used in malware development. The campaign, dubbed Operation Blacksmith, targeted companies in the manufacturing, agricultural, and physical security sectors. The Storm⚡Watch crew did a deep dive into Operation Blacksmith and Log4j/Log4Shell on the 2023-12-14 episode.
Given that unpatched weaknesses in Log4j present a clear and present danger to virtually every organization, there are some tangible actions you can take to keep your organization safe(r) in 2024:
The researchers of GreyNoise Labs would like to take a moment to thank the massive efforts of the communications and design teams who made this year-end vulnerability round-up as gorgeous and fun as it was (hopefully) informative. We’d also like to thank all the GreyNoise Community members who gave us nods of encouragement along the way.
Remember, GreyNoise has your back as we enter a new year full of new vulnerabilities and exploit campaigns.
Finally, mark your calendars! In January, we start the year strong with a webinar series that takes a deep, deep dive into the ecosystem of GreyNoise Tags.